Websphere JSESSIONID cookie overwrite between two apps on the same domain (different ports / context roots)

sessionwebsphere

Background

I have two webshpere apps

app1 on http://example.com:9080/app1
app2 on http://example.com:9081/app2

(installed on two separate profiles, and both the ports and context roots are different)

Scenario

When logging into app1, users get a JSESSIONID cookie X
When logging into app2 in another browser tab (IE8) user gets a JESSSIONID cookie Y

Problem

When logging into app2, the JSESSIONID cookie value Y overwrites the value X, thus invalidation the session of app1 (user is thrown back to login page if they do anything)

Question

Is that the default behavior? it looks weird that two web apps can share a JSESSIONID cookie
Is there a way to configure the two web apps to have JSESSIONID cookie isolation?

Best Answer

Those two apps are unaware of each other since they're in separate profiles. So I expect the second one sees a session ID it doesn't recognize, assumes it's an expired one, and creates a new one.

You can change one of the application's cookie name to something other than JSESSIONID or you can change its path so that it is only sent back for /app1 or /app2.

Either server-wide under Servers > Server name > Session Management > Enable Cookies or for the particular application(s) under Enterprise Applications > Application name > Session Management > Enable Cookies. If you choose the latter, you have to also check Override session management.

Related Solutions

Nginx – Inconsistent behavior with Nginx’s auth_request_set and more_set_input_headers

This behaviour is likely due to the fact that more_set_input_headers handler is executed before access phase (where auth_request works), and hence only changes a request if it's internally redirected.

Solution to the problem is to stop using more_set_input_headers (it's anyway very wrong, request headers shouldn't be changed) and use native fastcgi_param instead:

fastcgi_param HTTP_X_TEST_HEADER $auth_header;

Copied from http://mailman.nginx.org/pipermail/nginx/2014-June/044281.html.

Nginx – php5-fpm with nginx Session Not Maintained / Dropped Randomly

Figured out the problem myself. php5-fpm does not seem to parse the mode properly in the session.save_path PHP_ADMIN_VALUE fastcgi_param.

So, I created this bug:

https://bugs.php.net/bug.php?id=69658

This means that you cannot use 0;660;/path, as session_save_path() will return "0" instead of "/path". This works in Apache2 though. Hope this helps someone. Wasted too much time on this.